saharaprotocol[.]xyz

PhishDestroy identifies saharaprotocol.xyz as a credential theft phishing operation, assigned an elevated risk level. The domain impersonates the official Russian state services website (Портал государственных услуг Российской Федерации) to harvest login credentials and personal information from unsuspecting visitors. This specific threat type is designed to capture sensitive data such as usernames, passwords, and potentially government-related identifiers, posing serious risks to individuals and organizations.

The domain was created on June 27, 2025, through registrar Name.com, Inc, and resolves to the IP address 45.150.34.122. Security scanning on VirusTotal shows that 2 out of 95 security vendors flagged the domain as malicious, and it appears on three independent security blocklists. Notably, the domain lacks an SSL certificate, which is a strong indicator of fraudulent intent, as legitimate government portals always use HTTPS encryption. These technical indicators, combined with the domain's recent creation and the impersonation of a trusted government brand, confirm the malicious nature of saharaprotocol.xyz.

Users who have interacted with this domain should immediately change any passwords entered and enable two-factor authentication on all accounts, especially those related to government services or financial platforms. PhishDestroy recommends reporting the domain to local cybersecurity authorities and monitoring for any suspicious account activity. Avoid revisiting the site or providing any additional information, and ensure that your browser's anti-phishing protections are up to date.